Search: “CISA”

4 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 55 Advisory 24 Vulnerability 10 Industry 6 Policy & legal 4 Threat actor 4 Tools 3 AI safety & security 2 Data breach 1 Phishing & fraud 1

SeverityAll critical 45 high 31 medium 10 low 0 info 24

CISA decides weekly vulnerability bulletin isn't necessary anymore

CISA will discontinue its weekly vulnerability bulletin on September 28, pushing users toward KEV, alerts, and CVE data under risk-based prioritization.

CISA announced its weekly vulnerability bulletin will stop on Monday, September 28, as part of a shift from static CVSS severity scores to a modern, risk-based approach detailed in a June Binding Operational Directive. The directive prioritizes federal remediation based on exposure, exploitation evidence, control granted by exploitation, and whether exploitation can be automated. CISA directs bulletin subscribers to rely instead on its Known Exploited Vulnerabilities catalog, cybersecurity alerts and advisories, and the CVE catalog, requiring users to enable those subscriptions in GovDelivery or Granicus to avoid missing critical notices.

The Register · SecuritySep 16, 20:33 UTC · 17h agoPolicy & legal

What’s next for CISA’s CDM program that gives cybersecurity tools to federal agencies

CISA officials outline future plans for the CDM program, emphasizing speed, automation, unified data, and data-driven federal risk management.

Speaking at an Elastic Federal Cyber Defense Breakfast, CISA officials described next steps for the Continuous Diagnostics and Mitigation (CDM) program that supplies cybersecurity tools to federal agencies. Acting deputy program manager Richard Grabowski named velocity, unification, and data-driven risk management as core goals, including a three-year roadmap to expand SIEM-as-a-Service. Federal CISO Mike Duffy urged aggregating demand across agencies, buying outcomes rather than products, and designing acquisition for continuous improvement. CISA's Matt House tied the program's evolution to post-SolarWinds needs for a government-wide common operating picture.

CyberScoopSep 15, 19:45 UTC · 1d agoPolicy & legal

CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate

CISA and partners issue a joint advisory pressing organizations toward transparent breach notification and incident response as cyber outages escalate.

Dark Reading reports on a new joint government advisory led by CISA that signals a regulatory shift. The advisory presses organizations to adopt more transparent breach notification protocols and incident response practices. The guidance comes as cyber outages escalate and reflects growing government expectation of disclosure over spin.

Dark ReadingSep 11, 18:44 UTC · 5d agoPolicy & legal1

Authorities seize popular, long-running DDoS-for-hire service domainsnew

FBI and RCMP seized NightmareStresser DDoS-for-hire domains under Operation PowerOFF; the service enabled hundreds of thousands of attacks since at least 2022.

The Justice Department announced the court-ordered seizure of NightmareStresser's primary domain and related sites, executed by the FBI Anchorage field office and the Royal Canadian Mounted Police under Operation PowerOFF. The DDoS-for-hire service enabled hundreds of thousands of attacks or attempted attacks since at least 2022, targeting educational institutions, government agencies, gaming platforms, and millions of people. Authorities have seized more than 100 booter domains since 2018; operators remain unidentified and the service claimed to operate under Russian law.

CyberScoop13:37 UTC · 30m agoPolicy & legal 5 sources